Qsync Central CVE-2026-26243

Exploitation requires the attacker to first obtain a valid Qsync Central user account (PR:L), meaning this is an authenticated attack - it is NOT reachable by fully unauthenticated internet attackers against default configurations. Once authenticated, the attacker supplies path-traversal input to a file-handling function in Qsync Central to escape the intended directory and read files or system data outside the authorized scope. Limiting factors: valid credentials/account on the NAS are mandatory; risk is elevated on multi-user or publicly accessible QNAP deployments where untrusted users hold accounts, and reduced on single-admin or network-isolated installations. Affected versions are those prior to Qsync Central 5.0.0.6, 5.1.0.2, and 5.2.0.4.

This is a moderate-priority, authenticated information-disclosure flaw rather than a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring a valid low-privileged user account (PR:L), which materially limits mass exploitation. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' A significant internal conflict exists in the signals: the description states the attacker can 'read the contents of unexpected files or system data' (a confidentiality impact), yet the vendor vector sets VC:N (no confidentiality impact) while asserting VI:H and VA:H (high integrity and availability impact). For a CWE-22 path traversal described purely as a file-read primitive, the impact metrics appear mislabeled - confidentiality should be the primary impact. This discrepancy should be verified with QNAP before relying on the published 7.2 score for prioritization. Net: a real but authentication-gated issue warranting patching on exposed/multi-user NAS deployments, not an unauthenticated internet-wormable bug.

An attacker who has obtained or been granted a standard low-privileged Qsync Central user account sends a crafted request containing directory-traversal sequences to a file-handling endpoint. Because input is not properly constrained to the intended directory, the server returns the contents of arbitrary files outside the sync scope, such as configuration files, credentials, or other users' data. No public exploit code was identified at time of analysis, and the attack requires valid authentication (PR:L).